Adobe InDesign CVE-2026-34699

Exploitation requires the victim to manually open a maliciously crafted InDesign document (INDD/INDT/IDML or related supported file) in a vulnerable build of InDesign Desktop 21.3, 20.5.3 or earlier; the CVSS vector AV:L/UI:R confirms local attack vector with required user interaction. No authentication to any service is required (PR:N) and no elevated privileges are needed on the host, but the attacker must deliver the file to the user and convince them to open it in InDesign specifically - opening it in another viewer or preview tool does not trigger the bug. There is no network-facing service or daemon to exploit remotely.

The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields a base score of 7.8 (High) and reflects a classic client-side file-open exploitation profile: local attack vector with required user interaction but no privileges, leading to full confidentiality, integrity and availability impact. There is no CISA KEV listing, no POC reference, and no EPSS score provided, so this signals no public exploit identified at time of analysis and likely opportunistic rather than mass-exploited risk. The realistic priority is moderate-to-high for environments where designers routinely open externally sourced INDD/IDML files (agencies, publishers, marketing teams), and lower for locked-down endpoints; note that EPSS and exploit-maturity data are missing, so risk could shift if a POC surfaces.

An attacker emails a designer a malicious InDesign document (e.g., a fake brand-style template or vendor-supplied IDML) and entices them to open it; upon parsing, the heap-based buffer overflow triggers and shellcode executes as the logged-in user, giving the attacker the same access to documents, network shares and saved credentials as the victim. No public exploit identified at time of analysis, so the realistic near-term threat is targeted spear-phishing against creative and publishing teams rather than mass campaigns.